Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 10:06

General

  • Target

    21f5abfff9bbd80c65bfb67a2a0b360f_JaffaCakes118.exe

  • Size

    136KB

  • MD5

    21f5abfff9bbd80c65bfb67a2a0b360f

  • SHA1

    6709e2faae6cbc435d80038d8665d0fa441c5bcb

  • SHA256

    83f0eceed617552df47edc7801f5d9df8d2c2189355fbcf4b1cb372fe9c729f1

  • SHA512

    e09edb1e7a81885ba80173357e02d797f1c9ed9db67ee437d65a6cc93965d7ae74d5ad23ee2c28ddd9aac39386afc93cdd65d58f8ad643b0141c003e9ed5e8df

  • SSDEEP

    768:HbHnq6SkOWREB+tiaxq5wbuHZyYbwjt8vmEGuZ9NJ1/z0ggFIgHKcNFTBULJxyf/:bXYFaQ5wb7xEF/zT0KWFiLJ22BcQm+U

Score
8/10

Malware Config

Signatures

  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21f5abfff9bbd80c65bfb67a2a0b360f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\21f5abfff9bbd80c65bfb67a2a0b360f_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4172
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\lua\1.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1584
        • C:\PROGRA~1\INTERN~1\iexplore.exe
          C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?82133
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2620
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2620 CREDAT:17410 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:4948
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\lua\1.inf
          4⤵
            PID:1500
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\lua\2.bat
            4⤵
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:1116
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f
              5⤵
              • Modifies Internet Explorer settings
              • Modifies Internet Explorer start page
              PID:3988
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f
              5⤵
              • Modifies Internet Explorer settings
              • Modifies Internet Explorer start page
              PID:2828
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?S"" /f
              5⤵
                PID:2728
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
                5⤵
                • Modifies registry class
                PID:2056
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\lua\3.bat""" /f
                5⤵
                • Modifies registry class
                PID:1484
              • C:\Windows\SysWOW64\attrib.exe
                attrib +s +h C:\Users\Admin\AppData\Roaming\lua\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
                5⤵
                • Sets file to hidden
                • Views/modifies file attributes
                PID:1980
              • C:\Windows\SysWOW64\attrib.exe
                attrib +s +h C:\Users\Admin\AppData\Roaming\lua\tmp
                5⤵
                • Sets file to hidden
                • Views/modifies file attributes
                PID:1656
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\lua\2.inf
                5⤵
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:4872
                • C:\Windows\SysWOW64\runonce.exe
                  "C:\Windows\system32\runonce.exe" -r
                  6⤵
                  • Checks processor information in registry
                  • Suspicious use of WriteProcessMemory
                  PID:2996
                  • C:\Windows\SysWOW64\grpconv.exe
                    "C:\Windows\System32\grpconv.exe" -o
                    7⤵
                      PID:4900
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32 D:\VolumeDH\inj.dat,MainLoad
                  5⤵
                    PID:2824
            • C:\Users\Admin\AppData\Local\Temp\inl9826.tmp
              C:\Users\Admin\AppData\Local\Temp\inl9826.tmp
              2⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4804
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl9826.tmp > nul
                3⤵
                  PID:4908
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\21F5AB~1.EXE > nul
                2⤵
                  PID:3420

              Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

                      Filesize

                      471B

                      MD5

                      63a2d2b4cdc269762fe4bdb8cdfde7f8

                      SHA1

                      5cce14e5285ce9844b164d37de9f4ad0acc7880f

                      SHA256

                      8e323e0354939fd301d8db011a0b007476c93e0e048100922e3e59e34b04f716

                      SHA512

                      db3b35b23c3088fdf8f5215d8f9149e717d871be0c7b69541aba232e6f829e18d9d074b53f173387985a3ba4df1c016ec5b75f4387d6123c6c1ba3113c43dec9

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

                      Filesize

                      404B

                      MD5

                      fc4594808b3accd7d4d6bb3ffe88cd6c

                      SHA1

                      9a85b3ae1c0e138eba055dfe1df70c440888c8d7

                      SHA256

                      dede7f0e0e138b978784b8d3e781d554f12096202d7841d32c9ce39f22640004

                      SHA512

                      9d17e8017833e2d75bf861a632f8605d1172870d635e53dd120a1a835446184cc7e4edf877ef84103c4faf9d8c6c12ddcdc8c9e769cc5b8bc3ac7cc2363e7737

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W5OVUPOF\favicon[1].htm

                      Filesize

                      803B

                      MD5

                      9a56669fda653d180272060c91a1e932

                      SHA1

                      d5fd0bd68300df626aaad370ad96912f2edd3cf6

                      SHA256

                      37aa151bf0fc859681e856a3dad384f2344b542546e71d080ed7ac31abd79ac8

                      SHA512

                      e6a81e5e02a49a744ab62505d3d765a44f246c572f10b032a8e8137aba8b3f0c930ae8f5790c7104c0d1b4bfb9d5282363479954339758f932811260106ae6e1

                    • C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

                      Filesize

                      906B

                      MD5

                      f2572338cb20db1d928b2c61282e6e87

                      SHA1

                      8b2b79ef1c914b0b00ec10a06caa8638b2163d45

                      SHA256

                      e9bc7df9f665d307b049d0d8bf74ed3c2ac1564094d3c4eff2568742bb5ebbbd

                      SHA512

                      240c9e2b2de396ef9dbe6b823723c61ba12c50e9a3b11f5f8f826aa55984d6c18a83361bf5b8f5d2602dbf8152e9feb35ceadce11d098aed246c52dc02771763

                    • C:\Users\Admin\AppData\Local\Temp\tmp_ext.bat

                      Filesize

                      50B

                      MD5

                      e08ad52d3d132292f9c51e7cfec5fe08

                      SHA1

                      269f7eb185a9ff02664297bfb6f5df9f86ec10f0

                      SHA256

                      bd2a3003fb1f771283b30a044c49aecb72bfdff4322330337dba4992ecd198f4

                      SHA512

                      3dc0331f3ee9a57de7bda71a94953239bc7033a130f2b783b35d17ce3ed7b7928c154323d10ba81bd81d3bfd2d7c123cec55f5178d2b44286c2f857ccd6a1722

                    • C:\Users\Admin\AppData\Roaming\lua\1.bat

                      Filesize

                      2KB

                      MD5

                      68a30985a8b4a1dae5b24721ca5b8269

                      SHA1

                      78481107bbddcf18ffc4d25a184ec74274241a6b

                      SHA256

                      fe94352a25ade782ea77db82f1ec849479ebfe4605156142fc3fdfabc507a0cf

                      SHA512

                      d452182a296a9e202bce81ad0c752b34d4d779cac94bb54a07517936b79a4007127585673c524c75055f15e33c56eef0d26d1c448723a97fe70c15457bae5a24

                    • C:\Users\Admin\AppData\Roaming\lua\1.inf

                      Filesize

                      410B

                      MD5

                      66a1f0147fed7ddd19e9bb7ff93705c5

                      SHA1

                      9d803c81ea2195617379b880b227892ba30b0bf6

                      SHA256

                      4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

                      SHA512

                      cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

                    • C:\Users\Admin\AppData\Roaming\lua\2.bat

                      Filesize

                      3KB

                      MD5

                      c106ffc420b54a4f0fd331f10657dc66

                      SHA1

                      8930d5b56358f518bdf5ccca2b4d24f98ce7a03f

                      SHA256

                      fb8218f8c607ec3a4c4cb6e59ee81a94cf8ff513d0b09565ad456c88a9e7250b

                      SHA512

                      ee82fb57af0dddf8f1acab855cda151d3eacb8e11b0adc3a81852c1e2d77a566aa630ff5dabd8c7bc92ebe78b6187cc823c8a4a645ca78ee88e2c27483080fbd

                    • C:\Users\Admin\AppData\Roaming\lua\2.inf

                      Filesize

                      244B

                      MD5

                      524023ba7f18bfc502d22dbaade4571e

                      SHA1

                      fc118e1284db4e36da41d5cc4496ffa9a8b7cd2e

                      SHA256

                      5d170c83ca9a16ed7f62145099b3b8b0c0a1d4187e60bb0719754cb6ed40fc4c

                      SHA512

                      22384a0854a9949209444d9e7af3016327ad698e56797af246e02604b880949f40c7f4627303c11d73581c681b93bcee285b3937d4088c61107b9ec73901bdbc

                    • C:\Users\Admin\AppData\Roaming\lua\4.bat

                      Filesize

                      44KB

                      MD5

                      453848f2584f3077097aeb0184db57f9

                      SHA1

                      1adae922e19383e1c384effe8b9e5e6068b6879f

                      SHA256

                      eb5142d209e1e8ab8124fb2a6163e814d828d6bd2892aa0c64e5008835f64a9f

                      SHA512

                      fd6e93bccb2d020b250aeb56c557a922118ac9ed5821607e05fe29c2d74a766f430f6b00ec5668ecfe3f69d31cb67d199047ffef1f6da26ee791e5a36df3ff07

                    • memory/2620-41-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-81-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-62-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-61-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-59-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-68-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-71-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-70-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-69-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-66-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-64-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-63-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-58-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-55-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-52-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-50-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-48-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-46-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-45-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-42-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-51-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-73-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-74-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-76-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-75-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-53-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-77-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-82-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-84-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-85-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-91-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-86-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-97-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-96-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-101-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-99-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-98-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-95-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-126-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-44-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-128-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-132-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-133-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-134-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-131-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-130-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-127-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-49-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/2620-47-0x00007FFBAF7C0000-0x00007FFBAF82E000-memory.dmp

                      Filesize

                      440KB

                    • memory/5068-0-0x0000000000400000-0x0000000000422000-memory.dmp

                      Filesize

                      136KB

                    • memory/5068-115-0x0000000000400000-0x0000000000422000-memory.dmp

                      Filesize

                      136KB